#VU9125 Improper input validation in Cisco IOS XE - CVE-2017-12319
Published: November 8, 2017 / Updated: March 8, 2022
Vulnerability identifier: #VU9125
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:A/U:Clear
CVE-ID: CVE-2017-12319
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerable software:
Cisco IOS XE
Cisco IOS XE
Software vendor:
Cisco Systems, Inc
Cisco Systems, Inc
Description
The vulnerability allows a remote attacker to cause DoS condition on the target system.
The weakness exists in the Border Gateway Protocol (BGP) over an Ethernet Virtual Private Network (EVPN) for Cisco IOS XE Software due to changes in the implementation of the BGP MPLS-Based Ethernet VPN RFC (RFC 7432) draft. A remote attacker can send a specially crafted BGP Inclusive Multicast Ethernet Tag Route or BGP EVPN MAC/IP Advertisement Route update packet, corrupt the BGP routing table and cause the device to reload.
Successful exploitation of the vulnerability results in denial of service.
The weakness exists in the Border Gateway Protocol (BGP) over an Ethernet Virtual Private Network (EVPN) for Cisco IOS XE Software due to changes in the implementation of the BGP MPLS-Based Ethernet VPN RFC (RFC 7432) draft. A remote attacker can send a specially crafted BGP Inclusive Multicast Ethernet Tag Route or BGP EVPN MAC/IP Advertisement Route update packet, corrupt the BGP routing table and cause the device to reload.
Successful exploitation of the vulnerability results in denial of service.
Remediation
Update to version 16.3 or later.